Heap-based buffer overflow in the erf_read_header function in wiretap/erf.c in the ERF file parser in Wireshark 1.4.0 through 1.4.9 and 1.6.x before 1.6.3 allows remote attackers to cause a denial of service (application crash) via a malformed file.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2013-33:01 advisory.

    Wireshark is a network traffic analyzer for Unix-ish operating systems.
    This package lays base for libpcap, a packet capture and filtering library, contains command-line     utilities, contains plugins and documentation for wireshark. A graphical user interface is packaged     separately to GTK+ package.
    Security issues fixed with this release:
     CVE-2011-1958     Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 allows user-assisted remote attackers to cause a     denial of service (NULL pointer dereference and application crash) via a crafted Diameter dictionary file.
     CVE-2011-1959     The snoop_read function in wiretap/snoop.c in Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 does     not properly handle certain virtualizable buffers, which allows remote attackers to cause a denial of     service (application crash) via a large length value in a snoop file that triggers a stack-based buffer     over-read.
     CVE-2011-2175     Integer underflow in the visual_read function in wiretap/visual.c in Wireshark 1.2.x before 1.2.17 and     1.4.x before 1.4.7 allows remote attackers to cause a denial of service (application crash) via a     malformed Visual Networks file that triggers a heap-based buffer over-read.
     CVE-2011-2698     Off-by-one error in the elem_cell_id_aux function in epan/dissectors/packet-ansi_a.c in the ANSI MAP     dissector in Wireshark 1.4.x before 1.4.8 and 1.6.x before 1.6.1 allows remote attackers to cause a denial     of service (infinite loop) via an invalid packet.
     CVE-2011-4102     Heap-based buffer overflow in the erf_read_header function in wiretap/erf.c in the ERF file parser in     Wireshark 1.4.0 through 1.4.9 and 1.6.x before 1.6.3 allows remote attackers to cause a denial of service     (application crash) via a malformed file.
     CVE-2012-0041     The dissect_packet function in epan/packet.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5     allows remote attackers to cause a denial of service (application crash) via a long packet in a capture     file, as demonstrated by an airopeek file.
     CVE-2012-0042     Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 does not properly perform certain string conversions,     which allows remote attackers to cause a denial of service (NULL pointer dereference and application     crash) via a crafted packet, related to epan/to_str.c.
     CVE-2012-0066     Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service     (application crash) via a long packet in a (1) Accellent 5Views (aka .5vw) file, (2) I4B trace file, or     (3) NETMON 2 capture file.
     CVE-2012-0067     wiretap/iptrace.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause     a denial of service (application crash) via a long packet in an AIX iptrace file.
     CVE-2012-4285     The dissect_pft function in epan/dissectors/packet-dcp-etsi.c in the DCP ETSI dissector in Wireshark 1.4.x     before 1.4.15, 1.6.x before 1.6.10, and 1.8.x before 1.8.2 allows remote attackers to cause a denial of     service (divide-by-zero error and application crash) via a zero-length message.
     CVE-2012-4289     epan/dissectors/packet-afp.c in the AFP dissector in Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10,     and 1.8.x before 1.8.2 allows remote attackers to cause a denial of service (loop and CPU consumption) via     a large number of ACL entries.
     CVE-2012-4290 The CTDB dissector in Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10, and 1.8.x before     1.8.2 allows remote attackers to cause a denial of service (loop and CPU consumption) via a malformed     packet.
     CVE-2012-4291 The CIP dissector in Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10, and 1.8.x before     1.8.2 allows remote attackers to cause a denial of service (memory consumption) via a malformed packet.
    Fixed bugs:

     Fixed the parsing of link-local IPv6 addresses and Wireshark can prepare capture filter to omit SSH     packets over a link-local IPv6 connection.
     Wireshark's column editing does not brak column names any longer.
     TShark now properly analyzes the exit code of Dumpcap and propagates it correctly.
     The TShark -s (snapshot length) has been fixed: it now works fine with sizes lower that 68 bytes.
    Enhancement:
     Added support for the NetDump protocol was added.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2012-539:02 advisory.

    Wireshark is a network traffic analyzer for Unix-ish operating systems.
    This package lays base for libpcap, a packet capture and filtering library, contains command-line     utilities, contains plugins and documentation for wireshark. A graphical user interface is packaged     separately to GTK+ package.
    Security issues fixed with this release:
     CVE-2011-1143     epan/dissectors/packet-ntlmssp.c in the NTLMSSP dissector in Wireshark before 1.4.4 allows remote     attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted     .pcap file.
     CVE-2011-1590     The X.509if dissector in Wireshark 1.2.x before 1.2.16 and 1.4.x before 1.4.5 does not properly initialize     certain global variables, which allows remote attackers to cause a denial of service (application crash)     via a crafted .pcap file.
     CVE-2011-1957     The dissect_dcm_main function in epan/dissectors/packet-dcm.c in the DICOM dissector in Wireshark 1.2.x     before 1.2.17 and 1.4.x before 1.4.7 allows remote attackers to cause a denial of service (infinite loop)     via an invalid PDU length.
     CVE-2011-1958     Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 allows user-assisted remote attackers to cause a     denial of service (NULL pointer dereference and application crash) via a crafted Diameter dictionary file.
     CVE-2011-1959     The snoop_read function in wiretap/snoop.c in Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 does     not properly handle certain virtualizable buffers, which allows remote attackers to cause a denial of     service (application crash) via a large length value in a snoop file that triggers a stack-based buffer     over-read.
     CVE-2011-2174     Double free vulnerability in the tvb_uncompress function in epan/tvbuff.c in Wireshark 1.2.x before 1.2.17     and 1.4.x before 1.4.7 allows remote attackers to cause a denial of service (application crash) via a     packet with malformed data that uses zlib compression.
     CVE-2011-2175     Integer underflow in the visual_read function in wiretap/visual.c in Wireshark 1.2.x before 1.2.17 and     1.4.x before 1.4.7 allows remote attackers to cause a denial of service (application crash) via a     malformed Visual Networks file that triggers a heap-based buffer over-read.
     CVE-2011-2597     The Lucent/Ascend file parser in Wireshark 1.2.x before 1.2.18, 1.4.x through 1.4.7, and 1.6.0 allows     remote attackers to cause a denial of service (infinite loop) via malformed packets.
     CVE-2011-2698     Off-by-one error in the elem_cell_id_aux function in epan/dissectors/packet-ansi_a.c in the ANSI MAP     dissector in Wireshark 1.4.x before 1.4.8 and 1.6.x before 1.6.1 allows remote attackers to cause a denial     of service (infinite loop) via an invalid packet.
     CVE-2011-4102     Heap-based buffer overflow in the erf_read_header function in wiretap/erf.c in the ERF file parser in     Wireshark 1.4.0 through 1.4.9 and 1.6.x before 1.6.3 allows remote attackers to cause a denial of service     (application crash) via a malformed file.
     CVE-2012-0041     The dissect_packet function in epan/packet.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5     allows remote attackers to cause a denial of service (application crash) via a long packet in a capture     file, as demonstrated by an airopeek file.
     CVE-2012-0042     Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 does not properly perform certain string conversions,     which allows remote attackers to cause a denial of service (NULL pointer dereference and application     crash) via a crafted packet, related to epan/to_str.c.
     CVE-2012-0066     Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service     (application crash) via a long packet in a (1) Accellent 5Views (aka .5vw) file, (2) I4B trace file, or     (3) NETMON 2 capture file.
     CVE-2012-0067     wiretap/iptrace.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause     a denial of service (application crash) via a long packet in an AIX iptrace file.
     CVE-2012-1595     The pcap_process_pseudo_header function in wiretap/pcap-common.c in Wireshark 1.4.x before 1.4.12 and     1.6.x before 1.6.6 allows remote attackers to cause a denial of service (application crash) via a     WTAP_ENCAP_ERF file containing an Extension or Multi-Channel header with an invalid pseudoheader size,     related to the pcap and pcap-ng file parsers.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Heap-based buffer overflow in the erf_read_header function in wiretap/erf.c in the ERF file parser in     Wireshark 1.4.0 through 1.4.9 and 1.6.x before 1.6.3 allows remote attackers to cause a denial of service     (application crash) via a malformed file. (CVE-2011-4102)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-0125 advisory.

    - fixed CVE-2012-4285, CVE-2012-4289, CVE-2012-4291 and CVE-2012-4290       (#849521)
    - fixed various flaws: CVE-2011-1959 CVE-2011-2175 CVE-2011-1958       CVE-2011-2698 CVE-2011-4102 CVE-2012-0041 CVE-2012-0042 CVE-2012-0066       CVE-2012-0067

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-0509 advisory.

    [1.2.15-2.0.1.el6_2.1]
    - Add oracle-ocfs2-network.patch to allow disassembly of OCFS2 interconnect

    [1.2.15-2.1]
    - security patches
    - Resolves: CVE-2011-1143                 CVE-2011-1590                 CVE-2011-1957                 CVE-2011-1959                 CVE-2011-2174                 CVE-2011-2175 CVE-2011-1958                 CVE-2011-2597 CVE-2011-2698                 CVE-2011-4102                 CVE-2012-0041 CVE-2012-0066 CVE-2012-0067                 CVE-2012-0042                 CVE-2012-1595

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A heap-based buffer overflow flaw was found in the way Wireshark handled Endace ERF (Extensible Record Format) capture files. If Wireshark opened a specially- crafted ERF capture file, it could crash or, possibly, execute arbitrary code as the user running Wireshark.
(CVE-2011-4102)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2011-1958, CVE-2011-1959, CVE-2011-2175, CVE-2011-2698, CVE-2012-0041, CVE-2012-0042, CVE-2012-0066, CVE-2012-0067, CVE-2012-4285, CVE-2012-4289, CVE-2012-4290, CVE-2012-4291)

This update also fixes the following bugs :

  - When Wireshark starts with the X11 protocol being     tunneled through an SSH connection, it automatically     prepares its capture filter to omit the SSH packets. If     the SSH connection was to a link-local IPv6 address     including an interface name (for example ssh -X     [ipv6addr]%eth0), Wireshark parsed this address     erroneously, constructed an incorrect capture filter and     refused to capture packets. The 'Invalid capture filter'     message was displayed. With this update, parsing of     link-local IPv6 addresses is fixed and Wireshark     correctly prepares a capture filter to omit SSH packets     over a link-local IPv6 connection.

  - Previously, Wireshark's column editing dialog malformed     column names when they were selected. With this update,     the dialog is fixed and no longer breaks column names.

  - Previously, TShark, the console packet analyzer, did not     properly analyze the exit code of Dumpcap, Wireshark's     packet capturing back end. As a result, TShark returned     exit code 0 when Dumpcap failed to parse its     command-line arguments. In this update, TShark correctly     propagates the Dumpcap exit code and returns a non-zero     exit code when Dumpcap fails.

  - Previously, the TShark '-s' (snapshot length) option     worked only for a value greater than 68 bytes. If a     lower value was specified, TShark captured just 68 bytes     of incoming packets. With this update, the '-s' option     is fixed and sizes lower than 68 bytes work as expected.

This update also adds the following enhancement :

  - In this update, support for the 'NetDump' protocol was     added.

All running instances of Wireshark must be restarted for the update to take effect.

Updated wireshark packages that fix several security issues, three bugs, and add one enhancement are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Wireshark, previously known as Ethereal, is a network protocol analyzer. It is used to capture and browse the traffic running on a computer network.

A heap-based buffer overflow flaw was found in the way Wireshark handled Endace ERF (Extensible Record Format) capture files. If Wireshark opened a specially crafted ERF capture file, it could crash or, possibly, execute arbitrary code as the user running Wireshark.
(CVE-2011-4102)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2011-1958, CVE-2011-1959, CVE-2011-2175, CVE-2011-2698, CVE-2012-0041, CVE-2012-0042, CVE-2012-0066, CVE-2012-0067, CVE-2012-4285, CVE-2012-4289, CVE-2012-4290, CVE-2012-4291)

The CVE-2011-1958, CVE-2011-1959, CVE-2011-2175, and CVE-2011-4102 issues were discovered by Huzaifa Sidhpurwala of the Red Hat Security Response Team.

This update also fixes the following bugs :

* When Wireshark starts with the X11 protocol being tunneled through an SSH connection, it automatically prepares its capture filter to omit the SSH packets. If the SSH connection was to a link-local IPv6 address including an interface name (for example ssh -X [ipv6addr]%eth0), Wireshark parsed this address erroneously, constructed an incorrect capture filter and refused to capture packets. The 'Invalid capture filter' message was displayed. With this update, parsing of link-local IPv6 addresses is fixed and Wireshark correctly prepares a capture filter to omit SSH packets over a link-local IPv6 connection. (BZ#438473)

* Previously, Wireshark's column editing dialog malformed column names when they were selected. With this update, the dialog is fixed and no longer breaks column names. (BZ#493693)

* Previously, TShark, the console packet analyzer, did not properly analyze the exit code of Dumpcap, Wireshark's packet capturing back end. As a result, TShark returned exit code 0 when Dumpcap failed to parse its command-line arguments. In this update, TShark correctly propagates the Dumpcap exit code and returns a non-zero exit code when Dumpcap fails. (BZ#580510)

* Previously, the TShark '-s' (snapshot length) option worked only for a value greater than 68 bytes. If a lower value was specified, TShark captured just 68 bytes of incoming packets. With this update, the '-s' option is fixed and sizes lower than 68 bytes work as expected.
(BZ#580513)

This update also adds the following enhancement :

* In this update, support for the 'NetDump' protocol was added.
(BZ#484999)

All users of Wireshark are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add this enhancement. All running instances of Wireshark must be restarted for the update to take effect.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0125 advisory.

    Wireshark, previously known as Ethereal, is a network protocol analyzer. It     is used to capture and browse the traffic running on a computer network.

    A heap-based buffer overflow flaw was found in the way Wireshark handled     Endace ERF (Extensible Record Format) capture files. If Wireshark opened a     specially-crafted ERF capture file, it could crash or, possibly, execute     arbitrary code as the user running Wireshark. (CVE-2011-4102)

    Several denial of service flaws were found in Wireshark. Wireshark could     crash or stop responding if it read a malformed packet off a network, or     opened a malicious dump file. (CVE-2011-1958, CVE-2011-1959, CVE-2011-2175,     CVE-2011-2698, CVE-2012-0041, CVE-2012-0042, CVE-2012-0066, CVE-2012-0067,     CVE-2012-4285, CVE-2012-4289, CVE-2012-4290, CVE-2012-4291)

    The CVE-2011-1958, CVE-2011-1959, CVE-2011-2175, and CVE-2011-4102 issues     were discovered by Huzaifa Sidhpurwala of the Red Hat Security Response     Team.

    This update also fixes the following bugs:

    * When Wireshark starts with the X11 protocol being tunneled through an SSH     connection, it automatically prepares its capture filter to omit the SSH     packets. If the SSH connection was to a link-local IPv6 address including     an interface name (for example ssh -X [ipv6addr]%eth0), Wireshark parsed     this address erroneously, constructed an incorrect capture filter and     refused to capture packets. The Invalid capture filter message was     displayed. With this update, parsing of link-local IPv6 addresses is fixed     and Wireshark correctly prepares a capture filter to omit SSH packets over     a link-local IPv6 connection. (BZ#438473)

    * Previously, Wireshark's column editing dialog malformed column names when     they were selected. With this update, the dialog is fixed and no longer     breaks column names. (BZ#493693)

    * Previously, TShark, the console packet analyzer, did not properly analyze     the exit code of Dumpcap, Wireshark's packet capturing back end. As a     result, TShark returned exit code 0 when Dumpcap failed to parse its     command-line arguments. In this update, TShark correctly propagates the     Dumpcap exit code and returns a non-zero exit code when Dumpcap fails.
    (BZ#580510)

    * Previously, the TShark -s (snapshot length) option worked only for a     value greater than 68 bytes. If a lower value was specified, TShark     captured just 68 bytes of incoming packets. With this update, the -s     option is fixed and sizes lower than 68 bytes work as expected. (BZ#580513)

    This update also adds the following enhancement:

    * In this update, support for the NetDump protocol was added. (BZ#484999)

    All users of Wireshark are advised to upgrade to these updated packages,     which contain backported patches to correct these issues and add this     enhancement. All running instances of Wireshark must be restarted for the     update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This advisory updates wireshark to the latest version (1.6.3), fixing several security issues :

An uninitialized variable in the CSN.1 dissector could cause a crash (CVE-2011-4100).

Huzaifa Sidhpurwala of Red Hat Security Response Team discovered that the Infiniband dissector could dereference a NULL pointer (CVE-2011-4101).

Huzaifa Sidhpurwala of Red Hat Security Response Team discovered a buffer overflow in the ERF file reader (CVE-2011-4102).

The updated packages have been upgraded to the latest 1.6.x version (1.6.3) which is not vulnerable to these issues.

Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal.

Several flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark.
(CVE-2011-1590, CVE-2011-4102, CVE-2012-1595)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2011-1143, CVE-2011-1957, CVE-2011-1958, CVE-2011-1959, CVE-2011-2174, CVE-2011-2175, CVE-2011-2597, CVE-2011-2698, CVE-2012-0041, CVE-2012-0042, CVE-2012-0067, CVE-2012-0066)

Users of Wireshark should upgrade to these updated packages, which contain backported patches to correct these issues. All running instances of Wireshark must be restarted for the update to take effect.

Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal.

Several flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark.
(CVE-2011-1590, CVE-2011-4102, CVE-2012-1595)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2011-1143, CVE-2011-1957, CVE-2011-1958, CVE-2011-1959, CVE-2011-2174, CVE-2011-2175, CVE-2011-2597, CVE-2011-2698, CVE-2012-0041, CVE-2012-0042, CVE-2012-0067, CVE-2012-0066)

Users of Wireshark should upgrade to these updated packages, which contain backported patches to correct these issues. All running instances of Wireshark must be restarted for the update to take effect.

Huzaifa Sidhpurwala discovered a buffer overflow in Wireshark's ERF dissector, which could lead to the execution of arbitrary code.

The installed version of Wireshark is 1.6.x before 1.6.3.  This version is affected by the following vulnerabilities :

  - An error exists in CSN.1 dissector that can allow denial     of service attacks when processing certain malformed     packets. (CVE-2011-4100)

  - An error exists in the Infiniband dissector that can     allow a NULL pointer to be dereferenced when processing     certain malformed packets. (CVE-2011-4101)

  - A buffer overflow exists in the ERF file reader and can     be triggered when processing certain malformed packets.
    (CVE-2011-4102)

The installed version of Wireshark is 1.4.x before 1.4.10.  This version is affected by the following vulnerabilities :

  - An error exists in the Infiniband dissector that can     allow a NULL pointer to be dereferenced when processing     certain malformed packets. (CVE-2011-4101)

  - A buffer overflow exists in the ERF file reader and can     be triggered when processing certain malformed packets.
    (CVE-2011-4102)

ID	Name	Product	Family	Severity
288992	MiracleLinux 3 : wireshark-1.0.15-5.0.1.AXS3 (AXSA:2013-33:01)	Nessus	Miracle Linux Local Security Checks	high
283972	MiracleLinux 4 : wireshark-1.2.15-2.AXS4.1 (AXSA:2012-539:02)	Nessus	Miracle Linux Local Security Checks	high
217490	Linux Distros Unpatched Vulnerability : CVE-2011-4102	Nessus	Misc.	critical
68696	Oracle Linux 5 : wireshark (ELSA-2013-0125)	Nessus	Oracle Linux Local Security Checks	high
68516	Oracle Linux 6 : wireshark (ELSA-2012-0509)	Nessus	Oracle Linux Local Security Checks	high
63606	Scientific Linux Security Update : wireshark on SL5.x i386/x86_64 (20130108)	Nessus	Scientific Linux Local Security Checks	medium
63570	CentOS 5 : wireshark (CESA-2013:0125)	Nessus	CentOS Local Security Checks	medium
63408	RHEL 5 : wireshark (RHSA-2013:0125)	Nessus	Red Hat Local Security Checks	high
61934	Mandriva Linux Security Advisory : wireshark (MDVSA-2011:164)	Nessus	Mandriva Local Security Checks	medium
61303	Scientific Linux Security Update : wireshark on SL6.x i386/x86_64 (20120423)	Nessus	Scientific Linux Local Security Checks	medium
58849	CentOS 6 : wireshark (CESA-2012:0509)	Nessus	CentOS Local Security Checks	medium
58841	RHEL 6 : wireshark (RHSA-2012:0509)	Nessus	Red Hat Local Security Checks	medium
56884	Debian DSA-2351-1 : wireshark - buffer overflow	Nessus	Debian Local Security Checks	medium
56690	Wireshark 1.6.x < 1.6.3 Multiple Vulnerabilities	Nessus	Windows	medium
56689	Wireshark 1.4.x < 1.4.10 Multiple Vulnerabilities	Nessus	Windows	medium

Detections

Analytics

CVE-2011-4102

high

Tenable Plugins

high

high

critical

high

high

medium

medium

high

medium

medium

medium

medium

medium

medium

medium